Dustin Diaz, Head of Engineering

At Duro, we take security and compliance seriously. In today’s fast-paced digital age, protecting sensitive data is of utmost importance. That’s where SOC 2 comes in. SOC 2 is a framework that focuses on how organizations manage and process customer data. 

In addition to being ITAR compliant, Duro achieved its SOC 2 Type 1 certification in September 2023. We’re also well on the way to Type 2. This blog explains what this compliance measure is and why it’s so important. Additionally, we’ll outline the steps we’ve taken to protect our customer’s data.

What is SOC 2?

SOC 2 is a security framework that companies rely on to manage, process, and store customer data. It stands for Service Organization Control 2, and under the framework, companies must comply with various security, availability, confidentiality and privacy rules. Companies that adhere to SOC 2 standards are committed to protecting customer information. 

The five SOC 2 Trust Services Criteria:

  1. Security: The organization’s systems and data must be protected against unauthorized access, disclosure, and damage. It requires data encryption, authentication, access, monitoring, and incident response.
  2. Availability: Systems and services must be available for operation and use as agreed upon with customers. There must be adequate measures for system reliability, backup processes, and disaster recovery planning.
  3. Processing Integrity: Systems and processes must operate accurately, efficiently, and securely. 
  4. Confidentiality: Data is protected from unauthorized access or disclosure.
  5. Privacy: The organization must handle personal information carefully and ensure compliance with relevant privacy regulations. 

Audits and certification 

SOC 2 requires third-party attestation to assess one or more of the Trust Services Categories. Licensed audit firms generate these reports. There are two types of SOC 2 reports:

  • SOC 2 Type 1 focuses on a specific point in time to determine if the company was compliant at that moment. 
  • SOC 2 Type 2 reviews a company’s compliance over a period of time, typically the last continuous year. 

Why does SOC 2 matter?

SOC 2 certification gives you peace of mind that the software vendors you choose, will protect your data. It offers assurance that your Product Lifecycle Management partner has implemented adequate security controls to protect your sensitive data. 

In order to become compliant, independent auditing firms typically conduct SOC 2 reporting. This validation adds credibility and trust to the service organization’s claims about its security measures. Ensuring that your sensitive data is protected reduces the risk of data breaches and privacy violations.

The role of compliance and regulation in hardware

Duro works with distributed and highly collaborative hardware teams. Much of the content required to design and manufacture these products comes from a global ecosystem. As a result, there are various security and compliance requirements across different divisions within this ecosystem.

  • Engineers must protect their work from being overwritten. They need to preserve different versions and revisions for traceability and legal purposes. 
  • Subcontractors need to isolate their own systems from internally designed content. They need to carefully manage the relationships with each of their clients and keep documents separate.
  • Organizations require strict security standards such as SOC2, FedRAMP or ITAR to ensure compliance with regulatory bodies. They also need protection against rogue actors and cyber espionage.
  • Ecosystem vendors need to protect product data as it is transferred between systems. They require secure portals to ensure only authorized users have access to product records. 
  • Manufacturers require a way to track their parts to ensure integrity from the design to manufacture. 

Hardware engineering firms need to be able to trust the software vendors they choose with their data. And SOC 2 is just one part of that; it provides bolstered data security measures, increased credibility, a competitive advantage, adherence to regulations, and better risk management practices. It also results in more efficient internal processes, stronger customer relationships, enhanced supply chain security, and opportunities for continuous improvement.

Duro’s SOC 2 journey

Over the past few months, Duro has been enhancing its security measures. We’ve adopted best practices and technologies to safeguard sensitive customer data. Additionally, we’ve incorporated automated scanning and penetration tools, higher SLA standards, and increased access requirement restrictions. Through careful planning and execution, we streamlined various processes within our organization, making them more efficient and robust. 

Achieving SOC 2 Type 1 compliance is a testament to our dedication to building a reliable and secure platform. Here’s how this milestone positively impacts our customers:

  • Building Trust: Customers and partners can rely on us to handle their data with the utmost security and integrity.
  • Operational Efficiency: The improvements we’ve implemented not only meet compliance standards but also contribute to increased operational efficiency. By making these upgrades, we’re paving the way for a smoother, more streamlined workflow, enabling us to meet the security needs of our customers faster in the future.

What’s next for security at Duro

Duro’s engineering team strives for continuous improvement to offer a secure and reliable PLM platform. 

We are currently pursuing SOC 2 Type 2 certification, which we aim to complete by the end of 2023. This demonstrates our commitment to managing customer data responsibly through rigorous controls for security, availability, processing integrity, confidentiality, and privacy. Achieving SOC 2 further validates Duro as the best choice for agile hardware teams seeking to secure their BOM and product-related data.